The vulnerability in the Linux kernel KVM x86 subsystem involves a use-after-free condition in shadow paging caused by inconsistent handling of page roles (direct=1 vs direct=0) when modifying PDE mappings from outside the guest and subsequently deleting memslots. The issue arises because kvm_mmu_get_child_sp() reuses pages without verifying the role, and kvm_mmu_page_get_gfn() computes GFNs incorrectly for 4KB pages under a parent with direct=1, resulting in failure to remove reverse mapping entries. When the memslot is dropped, the shadow page is freed but stale rmap entries remain, leading to dereferencing freed shadow page table entries during later operations such as dirty logging or MMU notifier invalidation.

This vulnerability can cause the Linux kernel's KVM subsystem to dereference freed memory, potentially leading to kernel crashes or undefined behavior. It affects the integrity and stability of the virtual machine monitor's memory management but no known exploits are reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or patch links are provided in the available data. Users should monitor Linux kernel updates and apply patches once available to address this use-after-free vulnerability.